Blame · Line-by-line history

`wildcard-auth-gate-regression.test.ts`

Each line is annotated with the commit that last touched it. Click any SHA to jump to that commit and see the surrounding change.

wildcard-auth-gate-regression.test.tsBlame58 lines · 1 contributor

Normal view Raw

03e6f9bccantynz-alt	1	/**
	2	* Regression coverage for a systemic bug found via a full production HTTP
	3	* sweep: 13 route files registered their auth middleware with a glued
	4	* wildcard pattern (e.g. `router.use("/settings/tokens*", requireAuth)` --
	5	* no slash before the `*`). That pattern does not match the bare path at
	6	* all in this Hono version (confirmed via a standalone reproduction), so
	7	* the middleware silently never ran.
	8	*
	9	* Two of these (admin-security.tsx's /admin/security and /admin/soc2) were
	10	* a live, unauthenticated information-disclosure bug in production --
	11	* confirmed via `curl` returning a real 200 with the SOC 2 evidence
	12	* dashboard rendered, no login required. The rest crashed with a raw 500
	13	* (`c.get("user")!` dereferencing null) instead of leaking data, but were
	14	* equally broken as an auth gate.
	15	*
	16	* This file covers the requireAuth-gated ones not already covered by a
	17	* dedicated test file (admin-security.test.ts covers /admin/security +
	18	* /admin/soc2; ai-standup.test.ts covers /standups; admin.test.ts covers
	19	* /admin/autopilot/health, a related-but-distinct routing bug).
	20	*/
	21	import { describe, it, expect } from "bun:test";
	22
	23	async function expectLoginRedirect(path: string, init?: RequestInit) {
	24	const app = (await import("../app")).default;
	25	const res = await app.request(path, init);
	26	expect(res.status).toBe(302);
	27	expect(res.headers.get("location") \|\| "").toContain("/login");
	28	}
	29
	30	describe("wildcard auth-gate regression — requireAuth-protected settings pages", () => {
	31	it("GET /settings/tokens requires auth", async () => {
	32	await expectLoginRedirect("/settings/tokens");
	33	});
	34
	35	it("GET /api/user/tokens requires auth", async () => {
	36	await expectLoginRedirect("/api/user/tokens");
	37	});
	38
	39	it("GET /settings/sessions requires auth", async () => {
	40	await expectLoginRedirect("/settings/sessions");
	41	});
	42
	43	it("GET /settings/integrations requires auth", async () => {
	44	await expectLoginRedirect("/settings/integrations");
	45	});
	46
	47	it("GET /settings/agents requires auth", async () => {
	48	await expectLoginRedirect("/settings/agents");
	49	});
	50
	51	it("GET /settings/deploy-targets requires auth", async () => {
	52	await expectLoginRedirect("/settings/deploy-targets");
	53	});
	54
	55	it("GET /orgs/:slug/settings/secrets requires auth", async () => {
	56	await expectLoginRedirect("/orgs/test/settings/secrets");
	57	});
	58	});